Microsoft Defender ATP adds live response for Linux and macOS

Microsoft has announced the addition of new live macOS and Linux response capabilities to Defender for Endpoint, the enterprise version of Redmond's Windows 10 Defender antivirus.

The new capabilities are now available in public preview in the enterprise endpoint security platform (previously known as Microsoft Defender Advanced Threat Protection) and come with unique new commands for these platforms.

They are designed to help security operations (SecOps) teams to trigger response actions straight from the live response interface during incident investigations.

SecOps experts can use them to contain identified threats by enforcing network isolation, blocking attackers' attempts to exfiltrate data or move laterally through the network.

Other response actions added today for macOS and Linux customers also enable them to collect info on attackers' tools and techniques, and remotely trigger antivirus scans to detect and remediate malware infections on compromised devices.

With live response for macOS and Linux, analysts can do the following tasks:

• Run basic and advanced commands to investigate suspicious entities.
• Collect files (such as malware samples, scripts output) for offline analysis.
• Trigger response actions on the device.
• Upload any Bash script to their live response library, and then run it on the device to collect forensics evidence and remediate malicious entities.

"With live response, you have the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats -- in real-time," Microsoft said.

"Live response is designed to enhance investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats."

This update showcases Microsoft's ongoing effort to expand Defender for Endpoint's capabilities across all popular platforms to help security teams defend all endpoints using a unified security platform.

Microsoft Defender for Endpoint was made generally available for macOS devices in May 2019 and expanded to Linux and Android devices in June 2020.

Earlier this year, in April 2021, Microsoft also announced that Microsoft Defender for Endpoint supports Windows 10 on Arm devices.